bt-WebFilter Frequently Asked Questions

Q: How do I register my domain?

1. Open up the bt-WebFilter Management Console
2. Right click on the “Access Rules”
3. Click on “Register Domain”
4. Use the Drop Down box and select your Domain name or type in your Domain Name and click on the OK button

   NOTE: You can register more than one domain by repeating the above steps.

TOP

Q: How do I get a client Setup with ISA?

If a complete version of bt-WebFilter is already installed on a server and you wish to install the client version, perform the following steps:

1. Download the correct version of the bt-WebFilter application you are using (ISA or WebFilter)
2. Unzip the file to a folder on your computer
3. Open the location you extracted the files to and run the setup file
4. At the ‘WebFilter Setup Type’ screen, select “Client” and click “Next” to continue with the install. The Setup Connection Options screen displays
5. Enter the Server Name where the complete WebFilter is installed and click “Next” to continue with the install. The Ready to Install the Program screen displays. You are now ready to install the program
6. Click Install to install the bt-WebFilter Program After the program files are installed, the Install Shield Wizard Completed screen will display
7. Click “Finish” to exit the Wizard

   For additional information, please refer to page 24 of the WebFilter User Manual

TOP

Q: How do I setup authentication?

ISA 2004/2006:

Create an HTTP/HTTPS Access Rule:

1. Open up the ISA Management Console
2. Right-click on Firewall Policy, select “New” > “Access Rule”
3. Type in the Access Rule Name
4. Select “Allow” for the Rule Action, and click “Next”
5. Select “Selected protocols” for Protocols, and click the “Add” button
6. Under “Common Protocols”, add the “HTTP” and “HTTPS” protocols, then click “Close” and “Next”
7. Click the “Add” button for the Access Rule Sources
8. Under “Networks” select and add the “Internal” Network, then click “Close” and “Next”

   NOTE: This rule will allow HTTP/HTTPS access for the entire “Internal” network. If requiring authentication for another network, or IP range, replace the source as needed.

9. Click the “Add” button for the Access Rule Destinations
10. Under “Networks” select and add the “External” or “Internal” Network, then click “Close” and “Next”. Depending on the ISA or TMG server’s configuration, you will use a different destination network. For ISA or TMG Servers acting as a proxy only (1 NIC), the “Internal” network must be used. For ISA or TMG Servers acting as a Firewall (multi-homed server), the “External” network must be used
11. In the “User Sets” screen, remove the “All Users” user set and add the “All Authenticated Users” user set
12. Click the “Close” button, then Proceed to the next page by clicking “Next”
13. Click the “Finish” button
14. Apply the settings

bt-WebFilter Standalone Version

1. Open up the bt-WebFilter Console
2. Right click on the bt-WebFilter (Standalone version) at the top of the console and select properties
3. Click on the Proxy Options tab, and check the box next to “Ask Unauthenticated user for Identification”
4. Select your domain, then click on the Apply or OK button

TOP

Q: How do I Setup my TCP port?

1. Open up the bt-WebFilter Console
2. Right click on the bt-WebFilter Server and select Properties
3. Click on the Proxy Option tab
4. In the Common Options section type in your TCP port and click the OK button

TOP

Q: How do I create a custom category?

After starting the bt-LogAnalyzer or bt-WebFilter management console, follow the instructions below:

1. Right-click URL Control List in the left navigation tree
2. Select ‘New Category’ in the popup window
3. Enter a ‘Category Name’ and ‘Category Description’ and click ‘Apply’

TOP

Q: How do I create an appropriate URL mask?

Typically the user would use two masks to safely filter a certain domain into a desired category.

Following is how masks are input for the domain example.com:

*.example.com*;*//example.com*

Multiple masks can be entered at once when separated by a semicolon (;).

By enclosing each mask in the wildcard asterisks (*), the navigation to example.com directly or by use of any sub-domain, top-level domain, or folder within (such as mail.example.com or example.com/example1.asp), would also be covered.

TOP

Q: How do I include certain URLs in a category?

1. Open up the bt-WebFilter Console
2. Click the “+” next to the URL Control List
3. Right click on the Category you want to add the URL to and select Properties
4. Click on the Included URL’s tab and click the Add button
5. Type in the necessary URL address and/or mask, and then click the ‘Ok’ button
6. Click the Apply button, then click the Ok button

TOP

Q: How do I exclude certain URLs from a category?

1. Open up the bt-WebFilter Console
2. Click the “+” next to the URL Control List
3. Right click on the Category you want to exclude the URL from, and select Properties
4. Click on the Excluded URL tab and click on the Add button
5. Type in the necessary URL address and/or mask, and then click the ‘Ok’ button
6. Click on the Apply button, then the Ok button

TOP

Q: How do I create a Custom Schedule?

1. Open up the bt-WebFilter Console
2. Right click on Schedules and select New > Schedule
3. In the name field type in the name of the schedule
4. Click on the Properties tab, and highlight your time frame

TOP

Q: How do I setup and apply Quotas?

1. From the bt-WebFilter Console, select Quota
2. Right-click to display the Shortcut menu
3. Select New – > Quota
4. Enter the Quota Name
5. Select the Period of Validity:
   • Daily
   • Weekly
   • Monthly

6. Select the Severity Level:
   • Strict (Access denied when quota reached)
   • Lite (Access allowed – logs generated)

7. Click “Apply” to save your settings
8. Click “OK” when you have finished creating new quotas

TOP

Q: Assigning a quota to specific users?

After starting the WebFilter management console:

1. Right-click Domain in the left navigation tree, select Properties
2. Click the ‘Individual Rights’ tab
3. Click ‘Add’ and type the name of the user you want to assign the quota
4. Click on the user and select the ‘Edit’ button
5. Click on the ‘Quotas’ tab
6. Click ‘Add’ and make the choice of a ‘URL’ or ‘Category’ Access Object Type
7. Click on the ‘Details’ tab and either enter the URL masks or check the Categories that the quota will apply to
8. Click on the ‘Quota’ tab and select the correct quota from the drop down
9. Click ‘Apply’ and ‘OK’. Click ‘OK’ on any open screens

TOP

Q: How to set a single Quota for all Websites?

If you want to set a quota for all users to a specific value (e.g. 100MB) and have that quota calculate total for every website so that when the user reaches the quota limit all browsing is denied. Follow these steps:

1. Create a Quota and assign the calculation value (Time or Bandwidth)
2. Create a new Category called ‘All Websites’ and put a single * on the ‘Include’ tab.
   WARNING: By entering an * for the categories include field, ALL websites will be effected. Make sure that you exclude any URL’s that should not be applied to this Category such as a redirect URL. Any URL that is not excluded will not only be allowed access but will also count towards the Quota limits.
3. Create a Permission Type policy and add the ‘All Websites’ category to the ‘Allow’ tab
4. On the ‘Apply To’ and ‘Exemptions’ tab, add any users or groups that should be included/excluded from this policy
5. On the ‘Quota’ tab, click ‘Add’
6. On the ‘Common Options’ tab, select ‘Category’
7. Click the ‘Details’ tab and select the ‘All Websites’ category
8. Click the ‘Quota’ tab and select the Quota that you created in step 1
9. Click ‘Apply’ then ‘OK’
10. Click ‘Apply’ then ‘OK’ on the Permissions Properties page

Performing the above steps will cause every user assigned to be limited to the value specified in the Quota on a per user basis.

For example, ‘User A’ has used a combined total of 100MB of browsing activity but ‘User B’ has only used 25MB.

‘User A’ will be prevented from accessing any additional websites while ‘User B’ will still be able to browse for an addition 75MB of bandwidth.

Also, by using the settings above, all websites will be accessible as long as the user is under their Quota limit. In order to prevent access to unwanted websites, it will be necessary to create a second Custom Access Policy of a restriction type.

11. Create a new Custom Access Policy and set the access type to ‘Restriction’
12. On the ‘Deny’ tab, add all categories that you do not want user to have access to at all
13. On the ‘Apply To’ tab, enter the users that this should affect
14. On the ‘Deny’ tab, enter the users that this should not affect

TOP

Q: How do I Block some categories 24 by 7, restrict others by bandwith or time during specific hours?

Block ‘legal liability’ Web sites containing XXX, Criminal Skills, Extreme & Violent, Gambling, Hate Speech, and Hacking for all users, all day, every day.

For those same users, allow access to Entertainment, Humor, Shopping, and Sports categories before and after normal business hours and during lunch period. Additionally for the same group of users, limit the amount of time or bandwidth for each user for the ‘Entertainment,’ ‘Humor,’ ‘Shopping,’ and ‘Sports.’
After starting the bt-WebFilter management console:

A) Create a Schedule for the ‘Allow’ periods for Sports, etc.

1. Right-click Schedules in the left navigation tree, select ‘New Schedule’
2. Click Properties
3. Hold down the left mouse button dragging to select appropriate time period
4. Click the Active radio button
5. Click Apply and OK

B) Create a Schedule for the ‘Deny’ periods for Sports, etc.

1. Right-click Schedules in the left navigation tree, select ‘New Schedule’
2. Click Properties
3. Hold down the left mouse button dragging to select appropriate time period
4. Click the Active radio button
5. Click Apply and OK

C) Create a Quota for Entertainment, Sports, etc.

1. Right-click Schedules in the left navigation tree, select ‘New Quota’
2. Select Daily, Weekly or Monthly
3. Select Strict (block after quota is reached); Lite (report only after quota reached)
4. Input Bandwidth (KB) limit and/or Time limit
5. Click Apply and OK

D) Apply the ‘allow’ policy to Users.

1. Under the domain, right-click ‘Domain Users’ in the left navigation tree
2. Select properties
3. Click Allow tab
4. Click Add
5. In the new popup window, click Details
6. Check boxes for Entertainment, Humor, Shopping, and Sports
7. Click Schedule tab, from the drop down list, select the new ‘allow’ schedule created in step 1
8. Click Quota tab, from the drop down list; select the new Quota created in step 3
9. Click Apply and OK

E) Apply the ‘deny’ policy to Users.

1. Click Deny tab
2. Click Add
3. In the new popup window, click Details
4. Check boxes for Entertainment, Humor, Shopping, and Sports
5. Click Schedule tab and from the drop down list, select the new ‘deny’ schedule created in step 2
6. Check boxes for Sex, Criminal Skills, Extreme and Violent, Gambling, Hate Speech, Hacking
7. Click Schedule tab, from the drop down list, select ‘24 x 7′
8. Click Apply and OK

TOP

Q: How do I setup my Access Rules?

1. Open up the bt-WebFilter Console
2. Right click on “Access Rules” and select “Properties”
3. Select the type of Access Policy you want to apply (Restrictive, Permission, Combo)

TOP

Q: How do I setup a Custom Access Policy?

1. Open up the bt-WebFilter Console
2. Right click on the “Custom Access Policies”
3. Select New – > Custom Access Policy
4. Configure your policy
5. Click the Apply button
6. Click the OK button

TOP

Q: How do I Exclude users from a Custom Access Policy?

1. Open up the bt-WebFilter Console
2. Left click on the Custom Access Policies
3. In the right hand window pane, right click on your Policy and select Properties
4. Click on the Exemptions tab and click the Add button, and select User or IP
5. Select the user or type in the user name or IP address and click the OK button
6. Click the Apply button, then the OK button

TOP

Q: How do I Exclude a Group from a Custom Access Policy?

With bt-WebFilter 4.50.26 and above, it is now possible to exclude nested Active Directory groups from their parent groups defined in a “Custom Access Policy”.
Nesting occurs when one group is made a member of another group, and the nested group inherits all of the privileges and permissions that are granted to the parent.

Consider the Following Example:

The members of the Active Directory group “Finance” who are a subgroup of the “Business Services” group need access to the “Financial” category in WebFilter but not all members of the “Business Service Group” should be granted access.
In the bt-Webfilter console, you can use the “Display Group Members” feature locate and exempt the “Financial Group” from the Custom Access Policy.

To exempt members of one group from another group’s policy, do the following:

1. Open up the ISA Management console
2. Click the “+” next to Configuration
3. Click on Networks
4. On the Right pane, right click on the Internal, and select Properties
5. Click on the Web Proxy tab
6. Click on the Authentication button
7. Integrated should already be checked. Check the box next to require all users to authenticate.
8. Apply the changes

TOP

Q: How do I block Anonymous (Unauthenticated) users? (SA Only)

NOTE: Requiring Authentication will prevent ‘Anonymous’ users from accessing the proxy server.

To block Anonymous users when utilizing Active Directory

1. Open up the bt-WebFilter Console
2. Right click on the bt-WebFilter Server and select Properties
3. Click on the Proxy Options tab
4. In the Authentication section, click the check box next to ‘Ask unauthenticated users for identification’
5. Click the ‘Basic with this domain’ and select your domain
6. Select the ‘Integrated’ option
7. Click the Apply button, then the Ok button

TOP

Q: How do I block Anonymous (Unauthenticated) users? (ISA Only)

Blocking access to certain sites for Anonymous users in WebFilter for ISA can be used when you need to allow certain Machines to communicate to the internet anonymously but do not want them to be able to access certain sites such as XXX or Gambling.

1. In ISA/TMG, create an Access Rule that will allow the affected machines to access the proxy ‘Anonymously’
2. In WebFilter for ISA, create a new custom access Policy that blocks the categories/URLs that should not be accessed or use your existing policies
3. On the ‘Apply To’ tab under the Custom Access Policy’ properties, add the ‘Unauthenticated Access’ group

TOP

Q: Host your own Redirect Page?

1. Make sure bt-WebFilter Standalone or bt-WebFilter ISA plug-in is installed on the server that hosts the redirect page. The ISA server plug-in can be installed on a server without ISA server for the necessary components
2. Create and host a page on your server using the existing code from one of the redirect pages found in the WebFilter installation directory (indicated by .asp and .php file extensions). The original .asp or .php page may be used
3. Modify the page with the desired customizations
4. Launch bt-WebFilter and double-click on the access policy that you wish to modify
5. Under common information tab and text box labeled ‘redirect URL,’ type in the address of the Webpage you are redirecting to

Note: If using a 64 bit operating system, make sure the application pool allows 32 bit applications.

Note: The Redirect Page may be displayed in your language of choice.

TOP

Q: How do I filter by an IP Address Range?

1. Open up the bt-WebFilter Console
2. Click the “+” next to Access Rules
3. Right click on IP Range, and select Register IP Range
4. Type in the IP Address in the From field and the TO field, and click the Ok button
5. Configure the IP Range options, or create a Custom Access Policy and apply it to the IP Range

TOP

INSTALLATION, MAINTENANCE, AND TROUBLESHOOTING